Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Due to improper path santization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

WordPress Plugin php-mod/curl 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-9951 · Unknown · Php-Mod/Curl

Name of the Vulnerable Software and Affected Versions: php-mod/curl versions prior to 2.3.2 Description: The issue allows for XSS attacks via the post file path upload.php key parameter and the POST data to post multidimensional.php. This can potentially lead to malicious script execution. No...

CVE-2022-46662

Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and...

Design/Logic Flaw

Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and...

CVE-2022-46662

Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and...

CVE-2022-46662

Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and...

CVE-2022-46662

CVE-2022-46662 affects Roxio Creator LJB (Corel) with versions 12.2 build numbers 106B62B, 106B63A, 106B69A, 106B71A, 106B74A. A root cause is an unquoted Windows service path, so if a malicious executable is placed on the path, it may be run with the privileges of the Windows service. Documented...

Senayan Library Management System 9.2.2 SQL Injection

Title: Senayan Library Management System v9.2.2 a.k.a SLIMS 9 Multiple SQLi-Not sanitizing correctly cookie session. Author: nu11secur1ty Date: 12.20.2022 Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.2.2 Reference:...

CVE-2022-32833

An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16. An unauthorized user may be able to access browsing history...

Apple iOS 安全漏洞

Apple iOS is an operating system developed by Apple Inc. for mobile devices. A security vulnerability exists in Apple iOS versions prior to 16, which stems from a problem with the path to a file used to store website data, and can be exploited by an attacker to access browsing history. The...

Soil 跨站脚本漏洞

Soil is Roots open source a WordPress plugin . Used to apply theme-independent front-end modifications. A cross-site scripting vulnerability exists in Soil versions prior to 4.1.0, which originates in the function languageattributes in the file src/Modules/CleanUpModule.php, where manipulation of...

The vulnerability of the FortiClient.msi installer of the Fortinet FortiClient for Windows security solution allows a malicious individual to escalate their privileges.

The vulnerability of the FortiClient.msi installer of the Fortinet FortiClient for Windows security solution is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow attackers to increase their privileges...

Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download

The plugin does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. PoC 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin...

Path traversal

ILIAS before 7.16 allows External Control of File Name or Path...

PT-2022-27685 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 7.16 Description: The issue allows for external control of file name or path. Recommendations: For versions prior to 7.16, update to version 7.16 or later to resolve the issue...

CVE-2022-45918

CVE-2022-45918 affects ILIAS eLearning platform prior to 7.16. The vulnerability is External Control of File Name or Path, with upstream advisories and Red Hat corroborating that versions

CVE-2022-45918

ILIAS before 7.16 allows External Control of File Name or Path...

Senayan Library Management System 9.5.1 SQL Injection

Title: Senayan Library Management System v9.5.1 a.k.a SLIMS 9 SQLi Author: nu11secur1ty Date: 12.06.2022 Vendor: https://slims.web.id/web/ Software: https://slims.web.id/web/news/rilis-9.5.1/ Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.1...

xsjczx Shaoxing Background Management System SQL注入漏洞

The xsjczx Shaoxing Background Management System is a background management system from the Chinese company xsjczx punctuation information technology. A SQL injection vulnerability exists in xsjczx Shaoxing Background Management System, which originates from unknown code in the file /Default/Bd,...